Support various Authenticated Request methods

[mhyeon-lee]

Summary

OAuth2UserService requires various request schema support.
According to RFC 6750 Section 2. Authenticated Request, there are three ways to request user info.
https://tools.ietf.org/html/rfc6750#section-2

1. Authorization Request Header Field
2. Form-Encoded Body Parameter
3. URI Query Parameter

However, spring-security only supports Header field method.
So it need additional schema support.
Specifically, the Form-Encoded Body Parameter using the POST method.

The spring-security-oauth2 project supported the following optional options:
https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/AuthenticationScheme.java#L18

Configuration

I hope I can set it up as follows.

ClientRegistration.withRegistrationId("registrationId")
				...
				.userInfoUri(userInfoUri)
				.userInfoRequestSchema(UserInfoRequestSchema.FORM)  // default is HEADER
				.userNameAttributeName("user-name")
				...;

Version

5.0.6

[jgrandja]

@mhyeon-lee If the provider you're using does not support header auth scheme or it requires form/uri auth scheme, you can define your own implementation of OAuth2UserService and configure it via oauth2Login() as a workaround for now. See this example

[mhyeon-lee]

Yes, I have created a completely new implementation that implements OAuth2UserService just like the guide in version 5.0.6. Thank you for your guidance.
The newly created implementation is only different from the existing code and the UserInfoRequest generated code in NimbusUserInfoResponseClient.java.
https://github.com/spring-projects/spring-security/pull/5501/files#diff-d9691b8e8a86ea86740bc970ed3c9808R87

It would be nice to be able to make the schema(HttpMethod) selection of UserInfoRequest easily with java config.
Or you could easily set it up in DefaultOAuth2Service (setter / constructor), or you could inherit DefaultOAuth2Service and then support to override that implementation only.